Teleproctor reports use of a vehicle and restricts functions of drivers phone

ABSTRACT

A device in an automobile includes a camera that takes images of drivers while they are driving. It detects and reports when eyes are not on the road for longer than a glance with automated image processing. It also reports how much the car is driven, by whom, when, where, carrying what load, at what speed compared to the speed limit, with what pattern of hard breaking or hard cornering, whether the driver looked into the blind spot before changing lanes, and whether the driver allowed their phone to enter a restricted state while driving. The device may be built in or retrofit. The retrofit device can detect if it is depowered or removed from the vehicle and report this to the insurance company, rental company, parents, and employers.

This application claims priority from U.S. provisional applications61/693,079 filed Aug. 24, 2012 and 61/728,763 filed Nov. 20, 2012.

BACKGROUND

Auto insurance companies, auto rental companies, parents, and employerswould like to know how much a vehicle is driven, by whom, when, where,at what speed compared to the speed limit, carrying what load, andwhether any of the drivers take their eyes off the road for too long orengage in other risky driving behaviors. Parents and employers wouldlike reports on some of these items promptly upon occurrence. All fourwant assurance that the monitoring cannot be avoided by subterfuge.

Insurance companies and auto rental companies would offer lower rates ortrip-by-trip discounts where they are assured that technology is inplace to report the above information without possibility of avoidance.To be sure they qualify for lower rates, drivers would like immediatefeedback on actions that might preclude lower rates.

To reduce annoyance, avoid temptation, reduce risk, and show the vehicleowner and/or insurance company that they are a safe driver, some driverswould like their phones to automatically detect when they are drivingand, at those times, not ring with an incoming call unless the callerbelieves the call is important enough to be put though while the driveris driving, delay the ring of an incoming text until the vehicle isstopped, and display only a simple user interface that can be understoodwith quick glances. For drivers who do not use a cell phone, they wouldbe happy to receive lower insurance rates by accepting a system thatproves to the insurance company that they never hold a cell phone whiledriving,

SUMMARY

In the prior art, insurance companies incentivize customers to installin their autos cameras that take images of drivers while they aredriving and send the images to the insurance companies for human review.An improved device to do this and more, called a teleproctor, isdescribed. Detection and reporting of when eyes are not on the road forlonger than a glance is automated with image processing. The device alsoreports how much the car is driven, by whom, when, where, carrying whatload, at what speed compared to the speed limit, with what pattern ofhard breaking or hard cornering, whether the driver looked into theblind spot before changing lanes, and whether the driver allowed theirphone to enter a restricted state while driving. Reports of selectedevents can be sent to parents or employers promptly upon occurrence.Importantly, the removable retrofit device can detect if it is depoweredor removed from the vehicle and report this to the insurance company,rental company, parents, and employers.

Systems to provide the monitoring and reporting and screening of callscan be retrofit to existing vehicles at low cost. If there is sufficientdemand for the desired features, auto manufacturers will pre-install thehardware components to run software loaded by insurance companies,rental companies, parents, and employers.

The teleproctor is installed in the vehicle by the insured or built intoa new car. Installation for retrofit requires no skills. It is quick andeasy and gives immediate feedback whether successful or unsuccessful.The teleproctor merely needs to be adhered to the dashboard or thewindshield or the rear-view-mirror at a spot where the driver can see itand either a power wire is then plugged into a power source, such as aUSB port or a cigarette lighter receptacle, or the teleproctor includesa photovoltaic panel that charges its battery. To verify correct set up,the teleproctor sends a message via a radio network to a server and,when it receives an acknowledgment, beeps and flashes a green light.

The teleproctor collects data and wirelessly sends it to a centralrepository from which data is provided to the insurance company and/orthe car owner (rental company, parents, or employer). The teleproctorcan be set to give auditory reports and/or visual reports to the driverwhenever it reports to the insurance company that the driver wasexceeding the speed limit by more than a threshold or had eyes lookingaway from the road for too long while the car is moving or otherdetected behaviors, bad or good.

To report its data, the teleproctor can include wireless networkcommunications circuitry and a network account can be maintained fortransmission, like with the General Motors Onstar system. Alternatively,the teleproctor can send the data to a pre-identified mobile phone viaBluetooth or WiFi when that phone is in the vehicle and the phone runsan app that forwards the data in SMS messages or via internet to thedata repository. A vehicle owner or insurance company can instruct therepository to forward selected data events immediately upon receipt.

The teleproctor provides data to answer these questions:

-   -   1. How many minutes per week is the car driven? on which risky        roads at what times?    -   2. In each minute, what was the vehicle speed and what is the        speed limit as shown by a map for that location?    -   3. In each minute, was the car driven by the primary listed        driver? The number 2 listed driver? Number 3, etc.? A non-listed        driver?    -   4. In which minutes and for how long each time did the driver        take his or her eyes off the road?    -   5. Did the driver brake hard? corner hard? look in the blind        spot before changing lanes?    -   6. While driving, did the driver prevent their phone from        automatically entering a restricted mode to reduce distractions?    -   7. For each trip, what was the load added to the vehicle?    -   8. Where is the car now, what are current images of the driver        or driver's seat, and what are current sounds?    -   9. Was the teleproctor removed from the vehicle or depowered?

Although software in the teleproctor is sophisticated, the hardware costof each teleproctor is low. Most of the hardware is already present inmany new vehicles, such as the GM Onstar system. The labor cost ofretrofit installation is insignificant because each vehicle owner can doit themselves without expert guidance or review. The eye directionrecognition software need not be so effective that it detects every toolong glance away from the road. It only needs to detect enough of thetoo long glances away that the driver is deterred from risky behaviorand there is no way the driver can consistently avoid detection.

Similarly, the most important part of the subterfuge detectionsystem—detecting removal of the retrofit teleproctor from thevehicle—requires no extra hardware, merely sophisticated software. Thiscomponent of the teleproctor can be a valuable component to add to anydevice with radio circuits where detection of removal is important.

DESCRIPTION OF FIGURES

FIG. 1 shows a passenger vehicle with a teleproctor adhered to thewindshield.

FIG. 2 shows the circuit components of a teleproctor.

A. EYES AND FACIAL RECOGNITION

As shown in FIG. 1, the teleproctor 21 includes a camera 29 mounted on abase that includes electronic circuitry. The base need not be largerthan a small mobile phone. In new vehicles, the base may be built intothe dashboard. The camera housing includes an infra-red light emitterthat shines light not visible to humans toward the camera's field ofview. The camera pixel sensors detect both visible and infra-red light.

For retrofit, as shown in FIG. 1, the base may be adhered to thewindshield 15 near the rear view mirror. Alternatively, it may beadhered to the dashboard or affixed to the mirror. For retrofit, it hasa wire that leads to a plug for a USB port (5 volts) or to a 12 voltoutlet (cigarette lighter socket) or it includes a solar photovoltaicpanel that charges a battery.

The teleproctor includes an image processor circuit 28 which may beprogrammed to use image recognition to determine such events as:

-   -   (a) Is the camera pointed at a face recognized as a pre-listed        driver?    -   (b) While the car is moving faster than a threshold, are the        eyes looking away from the road too long for a glance in another        direction?    -   (c) Did the head turn in a manner typical of checking the blind        spot?

The teleproctor 21 is programmed to learn the necessary recognitiondetails automatically after the teleproctor is installed. Facial imageand eye position recognition methods are well known.

If the camera aim is changed so that it is not pointed at a human faceand the car is moving faster than a threshold, this fact is reported tothe driver and to the owner and/or insurance company.

When the teleproctor is installed, a first listed driver sits in thedriver's seat and adjusts the camera angle to point at his or her eyes.The driver clicks a button, then looks straight ahead at the road as ifdriving. Three seconds after the button was clicked, the teleproctorcaptures an image to save data characteristics of this face and theseeyes as the first listed driver in correct driving position. The userinterface for the teleproctor can be via a mobile phone or laptop ortablet computer with a Bluetooth or WiFi or similar connection. Data torecognize each other pre-listed driver—number 2, number 3, etc.—is alsostored in this way the first time each of them drives. The teleproctorthen determines when it is looking at one of these drivers and canreport the driver's identity with little data transmitted.

If a face is not recognized when the vehicle is moving, the teleproctorreports this fact to the driver. The driver will be reported to theowner and/or insurance company as a not-pre-listed driver unless thesystem is commanded to store the new facial data as the image of a newlylisted driver. The image of each face used to train the system istransmitted to the owner and/or insurance company and stored in theirrecords for human review if and when necessary. If a person changestheir facial appearance, by changing their glasses or other features,they simply reprogram the teleproctor to store their new facial datacharacteristics. The teleproctor can keep two or more stored sets offacial data for each driver, such as with dark glasses or clear glassesor with a hat, etc.

Instead of storing facial recognition data in the teleproctor, theentire original images may be uploaded to a central server where thefacial recognition processing is done. Then, each time the vehiclestarts moving from a stop long enough to change drivers, an image istaken and uploaded for facial recognition.

In addition to a facial recognition system for determining who isdriving, the teleproctor includes components for eye directiondetermination, such as by identifying the dark parts of eyes ascontrasted against whites of the eyes and computing metrics of the darkparts of eyes and the whites on each side of the dark parts. Any methodfor making these computations may be used. A suitable method for makingthese computations is in Appendix A. When the driver slightly changesposition while the vehicle is moving, the image processor may update thelooking-at-the-road eye position data set for the driver by assumingthat an eye position that is steady while the car is moving with onlyshort glances in other directions should be the basis for updating thedata set.

When the eye direction data changes significantly from thelooking-at-the-road data set and then returns to the looking-at-the-roaddata set within a window of time, the system concludes that the eyeswere not looking at the road. If the dark parts move to the side and theeye metrics change a large amount, the head has turned, such as to checkthe blind spot.

For optimal processing for each of eye direction recognition and facialrecognition, the effective brightness of the captured data in thevisible and infra-red spectra may be adjusted independently. Inaddition, the intensity of infra-red light emitted by the teleproctor toilluminate the face may be adjusted independently for each data set,giving a total of three possible brightness adjustments for each of eyedirection recognition and facial recognition purposes. For example, foreye direction determination when the driver is wearing dark glasses, thethree brightnesses will be adjusted for optimal distinction between thedark parts and whites of the eyes as seen through the dark glasses.Brightness adjustments suitable for use with dark glasses will typicallybe too bright for recognition of other facial features.

B. COLLECTING ADDITIONAL DATA Location, Speed, and Speed Limit

The teleproctor includes a determiner of location, speed, and speedlimit 27 which places into the data store 24 location data and speedrelative to the local speed limit. For a built-in teleproctor, thelocation, speed, and speed limit determiner 27 may get this data from aGPS with map circuit in the vehicle. In the retrofit teleproctor, thelocation, speed, and speed limit determiner 27 includes a GPS circuitand a stored digital map with speed limits for each location. The map isperiodically updated by download through the radio transceiver 30. Theteleproctor saves in the data store 24 the location, speed, and speedlimit data for reporting.

Acceleration.

The teleproctor includes at least two accelerometers. An accelerationdata processor can determine when lane changes are made and the imagerecognition processor can determine whether the driver first looked inthe blind spot. If the teleproctor is built into the vehicle, it can becoupled to data sources from the vehicle such as whether a turn signalwas activated before changing lanes and braking or turning data. Theacceleration data processor can determine when the driver causes hardbraking or cornering or speeding up. A summary of these determinationscan be uploaded to the data repository for review by the insurancecompany or owner.

Load.

Rental companies would like to know how much load their vehicle iscarrying on each trip as a gauge of wear. This information can be usedto set lower rates for people who carry light loads. Data from theaccelerometers on hard acceleration, hard cornering and hard braking isalso of interest to these companies because it increases tire wear.Parents and employers would like to know when the vehicle is being usedto carry extra passengers.

A load computation can be implemented with data showing power or fuelconsumption provided by engine sensors. The built-in teleproctorreceives input from the vehicle engine computer. When the engine poweroutput is high, either the vehicle is going up a hill or it isaccelerating. Using the speed determining circuits, these two factorscan be computationally separated. By comparing the power output tochange in speed and factoring out any hill incline, the load the vehicleis carrying can be computed. Another method to distinguish betweenclimbing a hill and speeding up uses a direction of gravity+accelerationsensor. By comparing the output of this sensor to change in speed, thesetwo factors can be separated.

A more direct method for obtaining load data to report is to add straingauges to one or more suspension springs of the vehicle. It may be atiny strain gauge that directly senses strain in the metal of the springor it may be a distance sensor that senses the distance that the springis collapsed overall. Placing the gauge on only one spring, a rearspring, may be sufficiently accurate. A wire is run from the straingauge to the teleproctor or to the vehicle's computer which passes thedata on to the teleproctor. Of course, the teleproctor circuits may bebuilt into the vehicle's computer circuits, with only the camera andother sensors being outside the vehicle computer circuits.

C. REPORTING DRIVING BEHAVIOR TO THE DRIVER AND THE INSURANCE COMPANYAND/OR VEHICLE OWNER

Collected data for each trip is stored in a data store 24 shown inFIG. 1. Periodically, a radio control processor 23 commands the radiotransceiver 30 to send new data in the data store 24 to a centralrepository 31 where it is repackaged and supplied to the insurancecompanies and/or car owner. The transmission route may go directly froma wireless network transmitter built into the teleproctor or thevehicle, in which case an account for the teleproctor is maintained inthe radio network, or it may pass via Bluetooth or WiFi to a phone ormobile wireless internet device in the car which acts as the first linkin a radio network 32.

Any programmable “smart” phone or other mobile wireless network devicecan be programmed with an “app” to perform this function automaticallywithout the device owner taking any action other than leaving the deviceand the app turned on whenever the device is in the vehicle. The deviceautomatically detects the Bluetooth or WiFi signal from the teleproctorand connects to it. The teleproctor and app together then determine howoften a data bundle is uploaded through the device. For example, if thedevice is in an area with poor reception, the uploads may be delayed.This uploading of the data can be programmed to happen the firstoccasion after a designated time each day that one of the designateddevice with Bluetooth or WiFi is in the car and the car is turned on, orother occasions. It can be programmed to happen immediately when certainevents are detected or upon request from the system server 31.

The teleproctor can be programmed so that, when a specified number ofevents of not looking at the road for longer than a threshold occurwithin a specified window of time, a report is immediately sent via theradio network. Similarly, it can be programmed to immediately send areport when speed over the speed limit is maintained for longer than athreshold amount of time or any other event. If the teleproctor detectsextreme deceleration suggestive of an accident, or upon request from thesystem server, it can transmit images from the teleproctor and soundscollected by a microphone in the teleproctor or the phone for a periodof time.

So that the actions of the image processor and the radio controlprocessor can be updated, they are each controlled by programs stored ina rewritable program store 25 which can be rewritten by download throughthe radio network 32 and loaded into the program store 25.

The teleproctor can upload data showing:

1. the start and stop (longer than a threshold such as 4 minutes) timesof all vehicle movement,

2. coordinates at each start or stop time,

3. coordinates at each turn relative to mapped roads to show each leg ofthe route taken on each trip,

4. number of minutes in each leg,

5. number of minutes in each leg that the vehicle speed exceeded thespeed limit by more than a threshold,

6. any hard breaking or cornering or extreme deceleration,

7. amount of load (or estimated number of passengers) carried on eachtrip,

8. number of times in each leg that the driver turned their eyes awayfrom the “looking at the road” direction for more than a thresholdduration and by how many tenths of seconds the threshold was exceeded,both a maximum and an average, and

9. whether the driver prevented their phone from automatically enteringrestricted mode controlled by the teleproctor.

The teleproctor can be set to play an auditory message to the driverthrough a speaker in the teleproctor or the driver's phone and/orpresent a visual message to the driver in a display for the driverwhenever speeding or eyes off the road or other events are reported tothe insurance company. With each message to the driver, the teleproctorcan tell the driver how much money the driver lost on insurance costsdue to speeding or eyes off the road, etc.

Data elements 1-7 above can be reported without adding a teleproctorcamera into the vehicle. Some vehicles and mobile telephones alreadyhave the required hardware. All that is required is software to bedownloaded into them to work as follows. A processor receives vehiclespeed from the vehicle, from either a speedometer or a GPS circuit inthe vehicle. The processor receives a speed limit from the GPS and astored map. The processor may be in the on-board vehicle electronicsassociated with the GPS or in a mobile telephone that communicates withthe on-board vehicle electronics via Bluetooth or WiFi. The phoneprovides acceleration data. The mobile telephone runs an app thatreceives the data and forwards it to the remote parties.

D. LEVELS OF RESTRICTED FUNCTIONALITY OF DRIVERS' PHONES WHILE DRIVING

As described above, each phone in the vehicle running an appropriate appcan automatically connect to the teleproctor for bi-directionalcommunication when the phone is in the vehicle. By facial recognition,the teleproctor can know which listed driver is driving the vehicle.With this information and prior cooperation by the usual drivers of thevehicle to load apps in their phones and list a phone identifier withthe teleproctor, the teleproctor can advise the driver's phone that itshould enter a restricted mode when the vehicle is moving. The usualdrivers' phones are each identified to the teleproctor when they firstconnect to it. Then, with the phone owner's acceptance by user input toload the app, the app will put the phone in a restricted mode wheneverthe teleproctor advises the phone that its owner is in the driver's seatand the vehicle is moving. If the driver's usual phone is not runningthe app to allow restriction, this suspicious circumstance can bereported to the vehicle owner or insurance company which can use thisinformation to set rates or rules.

An optimal form of functionality restriction might block all textmessage alerts or display and block all reading, writing, or other userinteractions with a display while moving, but, to accommodateemergencies, it should not block all voice communications while moving.Examples of restrictions that can be implemented in the phone include

-   -   1. Defer until the vehicle stops the playing of text ring        sounds;    -   2. Block displays to read text or to receive text input at the        keypad;    -   3. Block display of typical web pages which require focused        attention to glean information, allowing only simple displays;    -   4. For incoming calls, play a message to the caller that the        callee is driving and ask whether the call is important enough        to put through; the called phone would ring only if the caller        says “yes” or presses “1’.    -   5. When the vehicle takes certain actions, such as acceleration        or breaking or sharp turns, suspend voice calls and play an        explanatory tone or message to the remote party.    -   6. When the automobile's risk alerting forward looking radar        senses a risk or the GPS circuit with map indicates that a zone        of high risk (such as certain intersections) is being entered,        the teleproctor instructs the phone to play an alert sound into        any on-going telephone conversation or suspend the call so that        both parties know the driver needs to pay attention.

In restricted mode, all screen displays are so simple that a viewer canglean all available information with just a glance—no text beyond a fewwords to read, no large sets of items to choose from.

Level of attention required for driving can be approximated with theaccelerometers in the teleproctor. The teleproctor can advise thedriver's phone to enter a more restricted state when the vehicle isspeeding up or slowing down or turning or quickly changing lanes orrecently has been doing so. If it is built into the vehicle, theteleproctor can receive inputs from various vehicle sensors that suggestwhen more attention is required for driving. At these times, theoutgoing voice signal or the incoming voice signal or both can beinterrupted or suspended (and perhaps replaced with a sound or recordedwords) to reduce distraction for the driver and inform the other partyto the conversation that the driver needs to pay attention to driving atthis time.

There can be multiple levels of restriction based on time of day orlocation on a map in memory based on GPS location or other factors. Arestriction might be to stop the handset speaker from working andrequire use of a headset speaker.

Conversations with a passenger in a car present less of a distractionthan telephone conversations because the remote telephone conversantdoes not know what else the driver is doing simultaneously and what thedriver is seeing, while the passenger knows these things. The passengerunderstands what is happening when the driver pauses to concentrate ondriving. The concentration demands for a telephone conversation can bereduced and made more like the demands for conversation with a passengerby periodically playing a beep or other signal to the remote telephoneparty to remind them that the person they are talking to is alsodriving.

The app running in the driver's phone can be programmed so that, when acaller calls while the phone is in a restricted state, before the phonerings, a message is played to the caller saying: “The person you arecalling is driving. If this call is important enough to interrupt thatperson while driving, press 1 or say yes.” The called phone would onlyring if the caller presses 1 or says yes. Otherwise, the call isrerouted to voice mail.

As described above, for independent adult drivers, restricting phonesthat are moving to block texting and display interactions but onlytemporarily block voice communications while also accelerating may beoptimal. However, for children, or children and certain employees, theparent or employer may prefer a greater level of restriction. In thissystem, the phone owner can have a password that allows greaterrestriction to be placed on the phone. Here are examples of possiblevoice call restrictions that may be preferred in these situations foroutgoing calls.

-   -   (1) Only calls to 911 or any other listed emergency number are        allowed.    -   (2) Phone numbers of family members are listed with the app and        only calls to these numbers are put through.    -   (3) Speed dial calls are allowed but not calls requiring        pressing more than 3 keys.    -   (4) Voice calls to other than listed emergency numbers are cut        off after 3 minutes.

Here are examples of possible restrictions for incoming calls.

-   -   (5) The likely source phone numbers of family members are listed        with the app and only calls from these numbers are put through.    -   (6) Voice calls from those listed family member numbers are cut        off after 3 minutes.

E. AVOIDING POSSIBLE SUBTERFUGE

For the system to be valuable to insurance companies and vehicle rentalcompanies, there must be no way to defeat it that would keep lowinsurance rates or rental rates in place when they should not be kept inplace. Parents and employers have similar concerns. Subterfuges thatmight be attempted include:

1. Unplug or Remove the Teleproctor for Some Vehicle Trips.

The teleproctor includes a rechargeable battery that keeps it workingfor a length of time after it is depowered. In versions that do notinclude photovoltaic charging of the battery, when power to theteleproctor is lost, to determine whether the loss is due to a properswitch off of vehicle power or improper unplugging or removal of a powerfuse, the teleproctor sends a radio ping out the power wire and measuresthe radio echo signature by a process described below.

If the echo signature shows that power was lost due to vehicle powerswitch off, the teleproctor takes no action other than going into itsnormal sleep mode. If the echo signature shows that the teleproctor isunplugged or a fuse is removed, whether accidently or otherwise, itplays an auditory alert warning to plug it back in. If it is not soonplugged in to the same vehicle as determined by the echo signaturemethods described below, the teleproctor reports this fact to theinsurance company and/or owner.

To determine the cause of depowering, the teleproctor includes a circuitthat captures and records a radio-echo signature of the power source andits connections. Using its radio transmitter, which it has for Bluetoothor WiFi communication with the phone or for wide area data networkcommunication more directly to a server, the teleproctor emits a ping orseries of pings into the power wire. Using its radio receiver, theteleproctor records a signature of the echo to obtain a radio echosignature of the vehicle electronics.

The power wire echo will be different if the power source is a 12 voltto 5 volt converter such as for USB receptacles rather than a 12 voltsource such as from a cigarette lighter. It may also be affected byplugging other electronic devices into the vehicle. These changes can bedistinguished as not material changes because the echo will be vastlydifferent if the teleproctor is left unplugged or a fuse is removed orblown.

With known signature processing techniques, the echo data set may bereduced to a small but distinctive data set known as a signature hash.The algorithm for computing the hash is developed by collecting fullsignature data sets for many different vehicles and power supplies anddeveloping the algorithm to make the hash data set optimally small whilestill distinguishing between the plugged and unplugged or no fuseconditions in all cases, no matter what else may be plugged in.

Every time the retrofit teleproctor is powered, whether from turning onvehicle power or from unplugging and then plugging back in, a totalvehicle radio echo signature is obtained. For this, the radio echosignature is taken using the teleproctor's antenna for both broadcastand reception to obtain a signature of the entire vehicle, with a majorfactor being the shape of and relationship to all metal in the vehicleand a very minor factor being a change in the configuration of what'splugged into the vehicle's power and where it's plugged in. This allowsusers to unplug the retrofit teleproctor, make changes to what's pluggedin and where, and then plug in the retrofit teleproctor again without aproblem. If the total vehicle radio echo signature hash is the same asbefore, no alert is sent to the insurance company. For the built inteleproctor, no total vehicle radio echo signature capability isrequired.

The algorithm for computing the hash for the vehicle radio echosignature is developed by collecting full signature data sets for manydifferent vehicles and developing the algorithm to make the hash dataset optimally small while still distinguishing between as many vehiclemodels as possible and never computing two different hashes for the samevehicle even if the teleproctor's location within the vehicle is moved asmall enough amount to have no adverse effect on the functioning of theteleproctor.

A driver might, while the vehicle power is off, unplug the retrofitteleproctor, leave it unplugged for some trips, and then plug it backinto the same vehicle. To prevent this subterfuge, the back-up batteryhas enough power to last several days and, while depowered in sleepmode, the teleproctor wakes up periodically, about every 3 hours, andqueries the GPS to determine its location. If the location is not thesame as where the teleproctor went to sleep, the insurance companyand/or owner is notified.

A driver might, while the vehicle power is off, unplug the retrofitteleproctor and remove it from the vehicle, leaving it in the samelocation as where the teleproctor went to sleep while the vehicle drivesaway. To prevent this subterfuge, the back-up battery has enough powerto last several days and, while depowered in sleep mode, the teleproctorwakes up periodically, about every 3 hours, and takes a total vehicleradio echo to determine the radio reflection characteristics of itssurroundings and computes a hash. If the computed hash is not the sameas for the vehicle in which the teleproctor was installed, the insurancecompany and/or owner is notified.

For new cars with a built in teleproctor, the total vehicle echosignature never needs to be taken because the teleproctor cannot easilybe removed. For retrofit teleproctors, the original total vehicle echosignature hashes are computed when the teleproctor is initially set upand recomputed if it is set up again.

2. Point the Camera at a Manikin or Mask or Image of a Human Face.

The teleproctor is programmed to report that the data is likely wrong ifthe eye direction data does not change with glances away from the roadas much as is minimally human.

3. Point the Camera at a Passenger.

Unless the passenger is looking at the road as much as the driver shouldbe, this will not achieve the driver's objective—the glances away fromthe road by a passenger will be too long. If the driver points thecamera at a passenger who is instructed to stare intently at the roadahead, the face will not be recognized as a covered driver unless thedriver attempted to defraud the employer or insurance company byclaiming that the face on which the system was trained is the driver'sface, but this would be easily caught by a human looking at the photo ofthe face that was uploaded when the system was trained on that face.

Also, if the camera is not moved from its location in front of thedriver, the angle of looking at the passenger will be too oblique andthis will be automatically detectable by the image processor. If thecamera is moved from its proper location, the echo signature of thetotal vehicle will be detectably different.

4. Install a Bootlegged Teleproctor.

It is necessary to include a method for the data compiling system 31 toauthenticate each teleproctor. Otherwise, sociopathic entrepreneurscould make and sell bootlegged teleproctors that will give false andprettied-up data on use of the vehicle. The authentication method neednot be strong. It only needs to be strong enough to make it expensive tomake and sell an unauthorized teleproctor that will work adequately togo undetected more than about half of the time.

Crypto-authenticating chips are well known. They are designed to receiveas input a first data string and, in response, output a second datastring. When both data strings are processed together with a secret key,the result will show the second data string to have been produced by thecrypto-authenticating chip or not. The second string cannot beinexpensively determined from knowing the first string without havingthe key. The contents of the authenticating chip cannot be read andduplicated because a fusible link was burned after manufacture.

The data compilation server 31 sends a first data string to theteleproctor mounted in the vehicle which replies with a second datastring from a crypto-authentication circuit 22 included in theteleproctor. If the data compilation server determines that the stringsdo not match with the key, the data is so annotated.

Each teleproctor sends to the data compilation server 31 an identifierfor use to determine which key should be used. The identifier may be theteleproctor's mobile number in the network or it may be a separateidentifier stored in and sent by the authentication circuit 22 (e.g., aserial number).

An alternative design for an authentication circuit uses a clock in theteleproctor that is synchronized with a clock in the central server toperiodically change a data string that it sends to the server. Each newdata string must match what is expected to achieve authentication. Otherauthentication circuits are known and may be used.

Although teleproctors require approved authentication circuits 22 to bebuilt in by licensed manufacturers to avoid bootlegging of devices thatreport false information, the authentic teleproctors can be sold freelythough all channels of trade and installed by anyone.

5. Load a Bootlegged Program into the Teleproctor.

The server that checks for the authentication chip is the only componentthat is permitted to load an updated program into the teleproctor. Theauthentication chip is programmed to also check the credentials of theserver and insure that no other source can supply an updated program.

6. Block the Driver's Phone from Connecting to the Teleproctor.

The image recognition system identifies who is driving. If that person'slisted phone is turned off or not running the app such that theteleproctor cannot connect to it, this is reported, with adverseconsequences for the driver.

7. Carry a Non-Listed Phone as Well as a Listed Phone.

The image recognition system identifies who is driving. If that person'slisted phone is in the vehicle and running the app, the phone will entera restricted state as appropriate. If the driver uses a second,non-listed phone, it will not be in a restricted state, but the eyedirection monitoring system will still be watching the eyes andreporting too much eyes-off-the-road behavior. Whenever the eyes are offthe road too long, the system can upload an image of the driver's faceand upper body for possible human or automated review.

APPENDIX A Method of Computing Eye Direction Metrics

1. Find the pixels within the top half of the frame and the center halfof the frame that are darkest and set this value as the lightnessthreshold. Raise the lightness threshold until two groups are found, adistance apart within the range of possible pupil distances and roughlyhorizontal to each other. Looking only at pixels contiguous with eithergroup, incrementally raise the lightness threshold and count the numberof pixels added at each increment until the longest diameter of eachgroup reaches a maximum of possible pupil diameters. Separately for eachgroup, identify the lightness increment that added the smallest numberof pixels where the longest diameter is within a range of possiblediameters. If the longest diameter of each group is different, adjustthe increment one unit lighter for the smaller group or one unit darkerfor the larger group or both until the longest diameter of each group isthe same. This is the “pupil diameter”. The boundary of each groupdefines each “pupil”.

2. Compute a center of each pupil and define a line between the centersas “horizontal”.

3. At 35 degrees to the horizontal line, look at the lightness of eachpixel in each of four directions from each pupil (eight “rays”) to adistance from each pupil equal to half the pupil diameter. Raise thelightness threshold incrementally and count the number of pixels addedto each ray by each increment until no more pixels are added by anincrement. For each of the eight rays, the lightness increment thatadded the largest number of pixels defines the lightness of “the whites”of the eyes for that ray, and the total number of pixels added to thispoint for each ray is the “whites pixel count” along that ray.

4. For each eye, the whites pixel count for each of the four raysconstitutes a four dimensional “eye direction metric”. When the eyedirection metrics for the two eyes change by more than a threshold, theeyes are “not on the road”. The threshold is developed empirically.

The invention claimed is:
 1. A system for use in a vehicle to reducetraffic accidents, comprising: (a) a camera adapted for installation ina vehicle aimed at a typical location of a driver; (b) coupled to thecamera, an image processor circuit that identifies human eyes, records ausual appearance of eyes of a driver in an eyes-on-the-road position,and determines when the eyes are diverted to a position other than theeyes-on-the-road position by determining ellipticity of dark parts ofeyes contrasted with surrounding whites of eyes; (c) coupled to theimage processor circuit, a radio communications circuit with an antennaadapted for communications to a wide area radio network; (d) coupled tothe radio communications circuit, a speed determining circuit thatdetermines speed of movement of the vehicle; and (e) means for thecomponents to report to a server across the wide area radio network dataregarding incidents of eyes-off-the-road by the driver while the vehicleis moving faster than a threshold.
 2. The system of claim 1 wherein theimage processor circuit, to determine when the eyes are diverted to aposition other than the eyes-on-the-road position, also employs a methodof determining width of whites of eyes in at least one direction fromdark parts of eyes to a portion of the image that is discontinuouslyless white than the whites.
 3. The system of claim 1 further comprisingan infra-red light emitter mounted near the camera aimed to directinfra-red light onto the field of view of the camera.
 4. The system ofclaim 3 wherein the camera captures images in infra-red light as well asvisible light.
 5. The system of claim 4 wherein the image processorincludes a circuit that adjusts at least one of brightness of emissionsof infra-red light, sensitivity of capture of infra-red images, andsensitivity of capture of visible light images to optimize utility ofthe captured images.
 6. The system of claim 4 wherein the imageprocessor includes a circuit that adjusts at least two of brightness ofemissions of infra-red light, sensitivity of capture of infra-redimages, and sensitivity of capture of visible light images to optimizeutility of the captured images.
 7. The system of claim 1 wherein thespeed determining circuit is a GPS circuit.
 8. The system of claim 1wherein speed determining circuit receives speed data input from one ormore sensors in the vehicle that detect speed and report detected speedto the system.
 9. The system of claim 1 further comprising, coupled tothe radio communications circuit, an authenticating circuit adapted forauthenticating the communications circuit via the radio network to aremote server coupled to the radio network.
 10. The system of claim 9wherein the authenticating circuit is a crypto-authenticating circuitthat receives as input from the radio network a first data string and,in response, outputs a second data string to the radio network, whichsecond data string cannot be determined from knowing the first datastring without having a key.
 11. The system of claim 1 where thecomponents are assembled into a device adapted for retrofit into apre-existing automobile.
 12. The system of claim 1 where the componentsare built into a new vehicle as the vehicle is constructed.
 13. Thesystem of claim 1 further comprising a rechargeable battery power supplycoupled to a solar cell that charges the battery.
 14. The system ofclaim 1 wherein the image processor includes a circuit that, by imageanalysis, identifies head turning and determines whether the head turnedbefore a lane change.
 15. A method for determining when a driver in adriver's seat in a vehicle is not sufficiently keeping the driver's eyeson the road, comprising: a. having a camera mounted in front of thedriver's seat and aimed at where a driver's face is positioned whiledriving, coupled to an image processor and a speed determining circuit,the method comprising: b. receiving images from the camera andprocessing the images in the image processor to identify a pupil objectas a boundary between a set of pixels that are relatively dark comparedto surrounding pixels where the boundary is a complete ellipse having anellipticity less than a maximum and a length both greater than a minimumand less than a maximum; c. computing and saving a set of ellipticityvalues over time for the pupil object, and, for each ellipticity value,obtaining a speed value from the speed determining circuit andassociating the values; d. selecting ellipticity values that areassociated with a speed value above a threshold, classifying selectedellipticity values that are within a range close together in value andconstitute a majority of the values as eyes-on-the-road ellipticityvalues, and classifying selected ellipticity values that are outside therange as eyes-not-on-the-road values.
 16. A system for use in a vehicleto reduce traffic accidents, comprising: (a) a camera adapted forinstallation in a vehicle aimed at a typical location of a driver; (b)coupled to the camera, an image processor circuit that identifies humaneyes, records a usual appearance of eyes of a driver in aneyes-on-the-road position, and determines when the eyes are diverted toa position other than the eyes-on-the-road position by determining widthof whites of eyes in at least one direction from dark parts of eyes to aportion of the image that is discontinuously less white than the whites;(c) coupled to the image processor circuit, a radio communicationscircuit with an antenna adapted for communications to a wide area radionetwork; (d) coupled to the radio communications circuit, a speeddetermining circuit that determines speed of movement of the vehicle;and (e) means for the components to report to a server across the widearea radio network data regarding, incidents of eyes-off-the-road by thedriver while the vehicle is moving faster than a threshold.
 17. Thesystem of claim 16 further comprising an infra-red light emitter mountednear the camera aimed to direct infra-red light onto the field of viewof the camera.
 18. The system of claim 16 wherein the camera capturesimages in infra-red light as well as visible light.
 19. The system ofclaim 16 wherein the image processor includes a circuit that adjusts atleast one of brightness of emissions of infra-red light, sensitivity ofcapture of infra-red images, and sensitivity of capture of visible lightimages to optimize utility of the captured images.
 20. The system ofclaim 16 wherein the image processor includes a circuit that adjusts atleast two of brightness of emissions of infra-red light, sensitivity ofcapture of infra-red images, and sensitivity of capture of visible lightimages to optimize utility of the captured images.